Fix subdivide retry loop skipping inserted midpoints, update docs

The subdivide-on-failure logic used continue inside a for idx++ loop, which incremented idx past the newly-inserted midpoint checkpoint on every retry. The result: infinite retries of the same oversized range (visible in the linux smoke test as repeated pushes of 6.5M objects at the same from/to hashes).

Fix: convert to a manual-index loop (idx := start; for idx < len; ... idx++ at the bottom). Now continue retries at the same idx, where the checkpoint slice has been rewritten to start with the midpoint. Both the PACK-header precheck path and the post-push target-rejection path benefit from the same fix.

Also updates docs/bootstrap-batching.md:

• Checkpoint Selection section rewritten to describe the estimate-based approach (commit-count heuristic + PACK header precheck + target rejection retry) instead of the removed probe-based binary search.
• Practical Risks section updated with the new failure modes (estimate inaccuracy, non-uniform object density, source-side wasted pack builds on PACK header abort).